On Thursday 12 November, Microsoft 365 went down for a large share of its users worldwide. People could not open their Exchange Online mailboxes, Outlook, Teams or SharePoint, and email to Microsoft-hosted business mailboxes slowed to a trickle. As of 13 November Microsoft reports steady recovery, but the incident is not yet closed.
If you send email to customers or prospects on Microsoft 365, this page is about what the outage means for your mail, and what not to do while it clears.
What happened
- When: problems with Exchange Online mailbox access began on the afternoon of 12 November (UTC). Microsoft’s wider Microsoft 365 incident began at 1:26 PM ET (18:26 UTC) and ran into 13 November.
- Incidents: EX1550543 (Exchange Online) and MO1550821 (Microsoft 365, covering services that depend on Exchange Online). Both were still open on Microsoft’s service health dashboard at the latest updates.
- What broke: Microsoft said customers might be unable to connect to Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR, among others. Outage reports peaked in the tens of thousands on Downdetector.
- Email: users reported delayed mail arriving as services recovered. Microsoft said email delivery performance was improving, and according to BleepingComputer it extended its email timeout window to 48 hours to keep delayed messages while it worked through queues and backlogs.
What Microsoft has said
Microsoft first pointed to elevated load on its infrastructure across several regions, then said a large number of servers had become unexpectedly unavailable and were failing automated health checks. It reported that a process that sets up secure connections was being overwhelmed, rolled back a recent network configuration change, paused deployments, redistributed traffic and restarted affected servers.
Microsoft says it has no evidence of malicious activity. It has not confirmed the root cause and says it will publish a full post-incident report once the incident is mitigated. We will update this page when it does.
What it means if you send email
When a receiving mail system is unreachable or overloaded, mail is not rejected for good. Sending servers treat it as a temporary failure, keep the message in a queue and retry. That is why this outage shows up as delay, not loss.
- Delayed is not lost. Most messages sent to Microsoft 365 addresses during the outage are sitting in a queue, either at your sending platform or at Microsoft, and will arrive as recovery continues.
- Check your platform’s retry window. Mail servers usually keep retrying for several days, but many email platforms give up sooner. If yours gave up, those messages show as bounces. Resend only those, and only once Microsoft reports recovery.
- Don’t resend campaigns. The originals will keep arriving. A resend means recipients get the same email twice, which earns complaints.
- Don’t suppress addresses. Bounces and deferrals to Microsoft 365 recipients on 12 and 13 November are not a sign of bad addresses. Do not let your platform’s bounce rules remove them.
- Don’t change DNS or authentication. Nothing about SPF, DKIM, DMARC or your MX records caused this. Changing them now only adds risk.
- On Microsoft 365 yourself? Use message trace in the Exchange admin center to see messages that are still pending, and Service Health in the Microsoft 365 admin center for the latest on EX1550543 and MO1550821.
What to expect over the next few days
- Low opens and clicks from Microsoft-hosted recipients for anything sent on 12 and 13 November, and a late spike as the backlog lands. Don’t judge a campaign on those days.
- Expired codes and links. One-time codes, password resets and meeting links sent during the outage may arrive after they expire. Expect support requests and be ready to resend those individually.
- Gaps in DMARC reports. DMARC aggregate reports for 12 and 13 November may arrive late or not at all, so a dip in reported volume is not a sign of a problem with your domain.
Not the same as the Outlook.com DMARC bounces
From 6 to 9 November, a separate Microsoft problem made consumer Outlook.com, Hotmail and Live permanently reject some mail from domains with no DMARC record. That mail has to be resent. See Microsoft Outlook.com rejected mail from domains without DMARC.